[leinardi]

Summary

Every container that bind-mounts all of /dev contains standard symlinks into /proc and /run: /dev/fd, /dev/stdin, /dev/stdout, /dev/stderr, /dev/core, /dev/log and /dev/initctl. The daemon correctly skips each one as outside_dev, but it also logged a WARN for each of them. In the first 1.0.0 deployment that meant 7 warnings per /dev consumer on every reconcile pass.

After this change, these links are logged at DEBUG. The WARN stays for a path that an explicit allow glob names, because there the operator expected a device. This is the same rule the daemon already applies to dangling names (skipUnresolvable). Only the log level changes:

• the skip decision and the outside_dev skip metric are unchanged;
• the lexical gate still warns about a name that isn't under /dev at all;
• the message text is the same, so existing log searches still match.

Tests:

• TestCollect_SymlinkOutsideDevRejected now requires DEBUG when no allow glob names the link.
• The new TestCollect_SymlinkOutsideDevWarnsOnlyWhenAllowed checks that a matching link warns and a non-matching one logs at DEBUG.
• Both tests fail on the previous code.

The README, docs/architecture.md and the trust-boundary skill describe the new behavior.

Pull request checklist

• I am targeting the master branch
• I have rebased this branch on top of the destination branch
• I have executed make check locally before creating the commit and it has run successfully
• I have performed a self-review of my own code
• There are no WIP commits in this PR

Type of changes

• 🐛 Bug fix
• ✨ New feature
• 🔧 Refactoring
• 📜 Docs
• 🧰 CI / tooling / infra
• Other (describe in Summary)